sdr-visualizer 1.2.2__tar.gz → 1.2.4__tar.gz

sdr_visualizer-1.2.4/AGENTS.md

@@ -0,0 +1,194 @@
+# Repository guidance
+
+This is the canonical working guide for contributors and AI coding agents across
+this repository. Keep shared setup, validation, architecture, and contribution
+instructions here; `CLAUDE.md` and `CONTRIBUTING.md` point here instead of maintaining
+parallel copies. Detailed feature contracts remain in the linked documents.
+
+## Project and authority
+
+`sdr-visualizer` is a Python static-output visual catalog generator for Adobe
+Customer Journey Analytics (CJA) and Adobe Analytics (AA). It consumes JSON
+snapshots from `cja_auto_sdr` / `aa_auto_sdr` and emits one self-contained HTML
+report with catalog, reference graph, anatomy, comparison, and trend views.
+The package also installs the independent CJA-only `cja-lineage` command.
+There are no LLM calls or agent loops in the product.
+
+Read these documents for the area you are changing:
+
+- [Product contract](docs/PRODUCT_CONTRACT.md): supported inputs, stable public
+  surfaces, integrity/resource bounds, confidentiality, and compatibility. Read
+  before changing public behavior; do not silently expand or weaken the contract.
+- [Architecture](docs/ARCHITECTURE.md): data flow, module responsibilities, and
+  adding views or platforms.
+- [Adapter guide](docs/ADAPTER_GUIDE.md): snapshot shapes and sibling parity.
+- [Embedded data format](docs/EMBEDDED_DATA_FORMAT.md) and
+  [payload schema](docs/payload-schema.json): catalog payload contract.
+- [Workspace usage](docs/WORKSPACE_USAGE.md): optional collection/replay boundaries
+  and [usage schema](docs/workspace-usage-schema.json).
+- [Lineage](docs/LINEAGE.md): separate discovery input, CLI, and report contract.
+- [Performance](docs/PERFORMANCE.md): CI-gated Python and browser budgets.
+- [Releasing](docs/RELEASING.md): candidate, publication, and announcement evidence.
+
+## Setup and everyday development
+
+Requires Python 3.11+ and [uv](https://github.com/astral-sh/uv). Run from the repo root:
+
+```bash
+uv sync --locked --all-extras --dev --group browser
+uv run playwright install chromium webkit
+uv run pytest
+uv run ruff check
+uv run ruff format --check
+```
+
+The extras install the pinned AA/CJA SDKs for collection tests; base/offline use
+only requires Jinja2. The `dev` group supplies Python test/lint tooling and
+`browser` supplies Playwright. On Linux, use
+`uv run playwright install --with-deps chromium webkit` if browser system libraries
+are missing. `tests/conftest.py` generates missing large CJA/AA fixtures on demand.
+Do not commit generated performance fixtures or caches.
+
+Use `uv run ruff format` to format changes. Use a focused `uv run pytest tests/test_*.py`
+selection while iterating, then complete the PR checks below. Offline CLI smoke:
+
+```bash
+uv run sdr-visualizer tests/fixtures/cja_snapshot_clean.json --output /tmp/sdr-visualizer-check.html
+uv run sdr-visualizer --help
+uv run cja-lineage --help
+```
+
+## Validation before a PR
+
+Every PR needs a green suite, clean lint/format, and at least 99% combined line
+and branch coverage from the non-browser Python suite. Behavior changes need
+focused tests. Run both browser suites with Chromium and WebKit installed;
+skipped browser tests do not establish browser validation.
+
+```bash
+uv run pytest --ignore=tests/test_browser_functional.py --ignore=tests/test_lineage_browser.py \
+  --cov=sdr_visualizer --cov-branch --cov-report=term-missing \
+  --cov-report=json --cov-fail-under=99
+uv run pytest tests/test_browser_functional.py tests/test_lineage_browser.py -v
+uv run ruff check
+uv run ruff format --check
+uv run python scripts/check_markdown_links.py
+uv run python scripts/check_workflow_policy.py
+```
+
+The Markdown checker uses Git's tracked-file list. Stage newly added documents
+before running it so new links are validated against content that will ship.
+
+When a change could affect build size, rendering, or browser performance, run the
+performance gates. Generate their fixture sizes as CI does:
+
+```bash
+uv run python scripts/generate_large_fixture.py --scale 0.083 --output tests/fixtures/cja_snapshot_small.json
+uv run python scripts/generate_large_fixture.py --scale 0.417 --output tests/fixtures/cja_snapshot_medium.json
+uv run python scripts/generate_large_fixture.py
+uv run python scripts/generate_aa_large_fixture.py
+uv run python scripts/generate_large_fixture.py --scale 1.67 --output tests/fixtures/cja_snapshot_xl.json
+uv run python scripts/perf_check.py
+uv run python scripts/perf_lineage_poc.py
+uv run python scripts/perf_browser_check.py
+```
+
+If rendered output changes, run `uv run python scripts/generate_examples.py` and
+commit the refreshed `examples/*.html` in the same PR. CI verifies deterministic
+example drift and never pushes directly to `main`.
+
+For packaging changes, build and check the independently installed wheel and
+source distribution outside the checkout:
+
+```bash
+uv build --out-dir dist/packages
+uv run python scripts/package_smoke_check.py dist/packages/ --browser
+```
+
+Use an output directory containing exactly one wheel and one source distribution.
+Keep runtime dependencies limited to imports used by shipped code; tooling-only
+dependencies belong in `dev`. The sdist has an explicit allowlist in
+`pyproject.toml`; include new public documents there when needed. Release
+qualification requires the full [release checklist](docs/RELEASING.md), including
+fresh private-corpus/live-generator and explicit-commit sibling evidence; local
+fixtures and CI do not substitute for that evidence.
+
+## Architecture and invariants
+
+- Catalog pipeline: `cli/main.py` orchestrates `input/` loading/detection and
+  `adapters/` normalization into `core/models.py::Implementation`; `analysis/`
+  computes references, anatomy, diff, and trend; `render/data_payload.py`, render
+  helpers, Jinja templates, and embedded assets produce the report.
+- Lineage uses `cli/lineage.py`, `input/lineage_discovery.py`, `adapters/cja_lineage.py`,
+  `core/lineage.py`, `analysis/lineage_layout.py`, and the lineage render modules.
+  Its discovery input and internal payload are separate from catalog snapshots.
+- Workspace collection uses `cli/workspace_usage.py` and `usage/`; offline replay
+  uses `input/workspace_usage.py`. Binding lives in `core/workspace_usage.py` and
+  presentation in `render/workspace_usage.py`. Project evidence stays separate
+  from component references, graph, diff, and trend.
+- Python precomputes analysis and chart geometry. The browser reads embedded JSON,
+  filters data, and renders bounded DOM; it does not analyze raw snapshots.
+- Reports embed JSON, CSS, JavaScript, and vendored D3: no browser fetches, CDNs,
+  application server, or consumer build step. Live exporter invocation and explicit
+  optional Python-side Workspace collection follow their documented boundaries;
+  saved-input generation and replay stay offline.
+- Use vanilla JavaScript, with D3 confined to graph rendering. Do not add a frontend
+  framework or new JS dependencies. Preserve lazy initialization and display bounds.
+- The visualizer is descriptive: no grades, findings, or recommendations. Those
+  belong in [sdr-grader](https://github.com/brian-a-au/sdr-grader).
+- Preserve catalog exit codes: `0` success, `1` runtime failure, `3` invalid input;
+  never introduce catalog code `2`. The separate `cja-lineage` command retains
+  its documented argument-error code `2`. Treat snapshots as untrusted and retain
+  output-alias, structure-limit, Unicode, escaping, and non-finite JSON guards.
+- Color packs affect HTML presentation only, not the embedded/sidecar payload.
+
+## Sibling parity
+
+The normalized model, `adapters/{base,cja,aa}.py`, and
+`input/{loader,detect,shell_out}.py` originated in `sdr-grader`. Shared defensive
+behavior must be evaluated and mirrored in the same release cycle; a PR touching
+it must explain how parity is met. `input/series.py` is visualizer-only.
+When vendoring, rewrite `sdr_grader` imports to `sdr_visualizer`. Fixtures may
+intentionally diverge to exercise each project's features.
+
+Read [Vendoring parity with sdr-grader](docs/ADAPTER_GUIDE.md#vendoring-parity-with-sdr-grader)
+before syncing: shared coercion helpers stay behavior-identical, while grader-only
+evaluative helpers, visualizer numeric coercion, typed-reference metadata, and
+output protection have documented intentional differences. Do not copy over
+those differences indiscriminately. Color-pack source/accessibility contracts
+also require the explicit-SHA comparator described in
+[Sibling parity](docs/RELEASING.md#sibling-parity); derived role values are local.
+
+## Contribution and release discipline
+
+Keep changes focused and reviewable; preserve unrelated working-tree changes.
+Do not combine correctness, browser performance, automation, documentation, or
+community changes merely because they share a release target. Discuss non-trivial
+features in an issue first and surface unresolved contract questions there.
+Prefer a tighter feature set executed well over unnecessary scope expansion.
+
+Follow [CONTRIBUTING.md](CONTRIBUTING.md), the
+[code of conduct](CODE_OF_CONDUCT.md), and the [PR template](.github/PULL_REQUEST_TEMPLATE.md).
+PRs should describe resulting behavior, relevant validation, and any parity
+obligation. Maintainer self-review is permitted and independent approvals are
+currently not required; required checks still apply. Release maintainers
+re-inspect repository settings and record evidence before each release.
+
+Never add customer snapshots, identifiers, names, owners, formulas, source paths,
+credentials, or private corpus evidence to public commits/issues/PRs. Generated
+reports inherit their source's confidentiality. Report vulnerabilities privately
+as directed by [SECURITY.md](SECURITY.md). Do not run live collection or read
+maintainer credential sources as an unannounced test.
+
+Keep changes under `Unreleased` during development. The release commit bumps
+`pyproject.toml`, `src/sdr_visualizer/__init__.py`, and `uv.lock` together. In the
+same commit, rename `Unreleased` to the version and release date, add that version's
+link definition, update the comparison target, and add a fresh empty `Unreleased`
+section. Tag the release commit itself; never tag a commit containing `[skip ci]`.
+
+Follow [RELEASING.md](docs/RELEASING.md) for separately authorized tags, publication,
+and announcement gates. PyPI publication precedes the GitHub release; both verify
+the same `SHA256SUMS` manifest. If publication succeeds but the GitHub-release job
+fails, rerun only the failed `github-release` job against the retained artifact;
+never rerun successful publication or republish the same version. A green PR is
+not release or announcement authorization.

{sdr_visualizer-1.2.2 → sdr_visualizer-1.2.4}/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to `sdr-visualizer` will be documented here. The format foll
 
 ## [Unreleased]
 
+## [1.2.4] - 2026-10-17
+
+### Changed
+
+- Advance the catalog tested-through generator markers to `cja_auto_sdr`
+  3.12.12 and `aa_auto_sdr` 1.21.24. Snapshots declaring those versions no
+  longer raise a newer-than-tested warning; later versions remain accepted
+  with a compatibility warning. The separate lineage allowlist is unchanged.
+
+### Fixed
+
+- Label the lineage report footer “CJA lineage” instead of “Private CJA lineage POC”.
+
+## [1.2.3] - 2026-10-16
+
+### Fixed
+
+- Enforce the published performance budgets with decimal UTF-8 byte limits
+  and strict build, render, and filter timing boundaries in verification tools.
+- Preserve keyboard focus when paging Changes and Trend, and keep expanded
+  comparison details open as additional changes appear.
+- Preserve completed and partial Workspace SDK matches when process-group
+  signaling races with worker exit. Cleanup still fails if the worker does not
+  exit within the existing bounded wait.
+
+### Changed
+
+- Make live AA Workspace collection and manual assistive-technology testing
+  optional release evidence, retain automated accessibility and keyboard checks,
+  and scope release license signoff to project and vendored D3 notices.
+
+- Update the optional AA Workspace SDK to `aanalytics2==0.5.5.post2` and align
+  its collection version guard with the package pin.
+- Automatically review and merge verified, lockfile-only patch updates to
+  Ruff, pytest, and pytest-cov after all protected CI gates pass. Keep other
+  dependency changes on the manual-review path.
+- Replace the README catalog screenshot with a feature slideshow covering search,
+  references, anatomy, comparisons, trends, and offline reports across AA and CJA.
+
 ## [1.2.2] - 2026-09-21
 
 ### Changed
@@ -713,7 +752,9 @@ The following are explicitly internal and may change without notice:
 - Workspace project visualization (v0.4)
 - Schema map view (v0.5)
 
-[Unreleased]: https://github.com/brian-a-au/sdr-visualizer/compare/v1.2.2...HEAD
+[Unreleased]: https://github.com/brian-a-au/sdr-visualizer/compare/v1.2.4...HEAD
+[1.2.4]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.4
+[1.2.3]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.3
 [1.2.2]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.2
 [1.2.1]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.1
 [1.2.0]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.0

sdr_visualizer-1.2.4/CONTRIBUTING.md

@@ -0,0 +1,15 @@
+# Contributing to sdr-visualizer
+
+Thanks for your interest. This project has a deliberately tight scope. Read
+[AGENTS.md](AGENTS.md), the canonical guide for contributors and coding agents,
+before making changes. It covers setup, development, required validation,
+architecture, sibling parity, and contribution discipline.
+
+Discuss non-trivial features in an issue before implementation. Use the
+[PR template](.github/PULL_REQUEST_TEMPLATE.md) to describe your change and record
+validation. By participating, you agree to follow the
+[code of conduct](CODE_OF_CONDUCT.md). Report security issues privately as described
+in [SECURITY.md](SECURITY.md).
+
+For maintainer release work, use the full candidate, publication, and announcement
+checklist in [docs/RELEASING.md](docs/RELEASING.md).

{sdr_visualizer-1.2.2 → sdr_visualizer-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sdr-visualizer
-Version: 1.2.2
+Version: 1.2.4
 Summary: Static-output visual catalog generator for Adobe Customer Journey Analytics and Adobe Analytics implementations.
 Project-URL: Homepage, https://brian-a-au.github.io/sdr-visualizer/
 Project-URL: Documentation, https://github.com/brian-a-au/sdr-visualizer#documentation
@@ -14,7 +14,7 @@ License-File: THIRD_PARTY_LICENSES
 Requires-Python: >=3.11
 Requires-Dist: jinja2>=3.1
 Provides-Extra: workspace-aa
-Requires-Dist: aanalytics2==0.5.3.post1; extra == 'workspace-aa'
+Requires-Dist: aanalytics2==0.5.5.post2; extra == 'workspace-aa'
 Requires-Dist: requests>=2.32; extra == 'workspace-aa'
 Provides-Extra: workspace-cja
 Requires-Dist: cjapy==0.3.1; extra == 'workspace-cja'
@@ -41,7 +41,10 @@ Static-output visual catalog generator for Adobe Customer Journey Analytics (CJA
 - Per-calculated-metric formula trees with click-through to referenced metrics
 - Snapshot-to-snapshot Changes and multi-snapshot Trend views
 
-![The catalog view: header stats strip, search and filters, and the component table](https://raw.githubusercontent.com/brian-a-au/sdr-visualizer/main/docs/screenshot-catalog.png)
+[![Slideshow of the searchable catalog, reference graph, segment and formula anatomy, snapshot changes, trends, and offline HTML reports for AA and CJA](https://raw.githubusercontent.com/brian-a-au/sdr-visualizer/main/docs/screenshot-catalog.gif)](https://raw.githubusercontent.com/brian-a-au/sdr-visualizer/main/docs/screenshot-catalog.png)
+
+28.5-second loop · Actual report excerpts from synthetic AA and CJA snapshots.
+Click the animation for a still image.
 
 **Live examples:** [CJA report](https://brian-a-au.github.io/sdr-visualizer/cja-typical.html) · [AA report](https://brian-a-au.github.io/sdr-visualizer/aa-typical.html)
 
@@ -337,25 +340,7 @@ Warnings (snapshot generator newer than the tested version; 5,000+ component rep
 
 ## Develop
 
-Requires Python 3.11+ and [uv](https://github.com/astral-sh/uv).
-
-```bash
-uv sync --all-extras --dev --group browser  # Full test environment, including SDK tests
-uv run playwright install chromium webkit
-uv run pytest                               # Run tests (auto-generates the large fixture on first run)
-uv run ruff check      # Lint
-uv run ruff format     # Auto-format
-
-uv run python scripts/generate_examples.py   # Regenerate examples/
-uv run python scripts/check_color_pack_parity.py \
-  --visualizer-sha <candidate-commit-sha> \
-  --grader-root ../sdr-grader --grader-sha <linked-grader-commit-sha>
-uv run python scripts/perf_check.py          # Run the perf gate
-uv run python scripts/check_markdown_links.py
-uv run python scripts/check_workflow_policy.py
-uv build --out-dir dist/packages
-uv run python scripts/package_smoke_check.py dist/packages/
-```
+See [AGENTS.md](https://github.com/brian-a-au/sdr-visualizer/blob/main/AGENTS.md) for the canonical contributor and AI-agent guide: Python/uv setup, development commands, validation, architecture, and contribution instructions.
 
 ## CJA dataset lineage
 
@@ -396,6 +381,8 @@ component catalogs for either CJA or Adobe Analytics (AA).
 
 ## Documentation
 
+- [`AGENTS.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/AGENTS.md) — canonical contributor and coding-agent working guide.
+
 - [`docs/WORKSPACE_USAGE.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/docs/WORKSPACE_USAGE.md) — optional AA/CJA collection, generated usage files, offline replay, and evidence limits.
 
 - [`docs/LINEAGE.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/docs/LINEAGE.md) — CJA-only lineage generation, navigation, compatibility, and limits.

{sdr_visualizer-1.2.2 → sdr_visualizer-1.2.4}/README.md

@@ -18,7 +18,10 @@ Static-output visual catalog generator for Adobe Customer Journey Analytics (CJA
 - Per-calculated-metric formula trees with click-through to referenced metrics
 - Snapshot-to-snapshot Changes and multi-snapshot Trend views
 
-![The catalog view: header stats strip, search and filters, and the component table](https://raw.githubusercontent.com/brian-a-au/sdr-visualizer/main/docs/screenshot-catalog.png)
+[![Slideshow of the searchable catalog, reference graph, segment and formula anatomy, snapshot changes, trends, and offline HTML reports for AA and CJA](https://raw.githubusercontent.com/brian-a-au/sdr-visualizer/main/docs/screenshot-catalog.gif)](https://raw.githubusercontent.com/brian-a-au/sdr-visualizer/main/docs/screenshot-catalog.png)
+
+28.5-second loop · Actual report excerpts from synthetic AA and CJA snapshots.
+Click the animation for a still image.
 
 **Live examples:** [CJA report](https://brian-a-au.github.io/sdr-visualizer/cja-typical.html) · [AA report](https://brian-a-au.github.io/sdr-visualizer/aa-typical.html)
 
@@ -314,25 +317,7 @@ Warnings (snapshot generator newer than the tested version; 5,000+ component rep
 
 ## Develop
 
-Requires Python 3.11+ and [uv](https://github.com/astral-sh/uv).
-
-```bash
-uv sync --all-extras --dev --group browser  # Full test environment, including SDK tests
-uv run playwright install chromium webkit
-uv run pytest                               # Run tests (auto-generates the large fixture on first run)
-uv run ruff check      # Lint
-uv run ruff format     # Auto-format
-
-uv run python scripts/generate_examples.py   # Regenerate examples/
-uv run python scripts/check_color_pack_parity.py \
-  --visualizer-sha <candidate-commit-sha> \
-  --grader-root ../sdr-grader --grader-sha <linked-grader-commit-sha>
-uv run python scripts/perf_check.py          # Run the perf gate
-uv run python scripts/check_markdown_links.py
-uv run python scripts/check_workflow_policy.py
-uv build --out-dir dist/packages
-uv run python scripts/package_smoke_check.py dist/packages/
-```
+See [AGENTS.md](https://github.com/brian-a-au/sdr-visualizer/blob/main/AGENTS.md) for the canonical contributor and AI-agent guide: Python/uv setup, development commands, validation, architecture, and contribution instructions.
 
 ## CJA dataset lineage
 
@@ -373,6 +358,8 @@ component catalogs for either CJA or Adobe Analytics (AA).
 
 ## Documentation
 
+- [`AGENTS.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/AGENTS.md) — canonical contributor and coding-agent working guide.
+
 - [`docs/WORKSPACE_USAGE.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/docs/WORKSPACE_USAGE.md) — optional AA/CJA collection, generated usage files, offline replay, and evidence limits.
 
 - [`docs/LINEAGE.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/docs/LINEAGE.md) — CJA-only lineage generation, navigation, compatibility, and limits.

sdr_visualizer-1.2.4/docs/DEPENDABOT_AUTOMATION.md

@@ -0,0 +1,116 @@
+# Dependabot review and auto-merge
+
+The repository automatically reviews and merges **patch updates to `ruff`,
+`pytest`, and `pytest-cov`** when all required CI checks pass on an up-to-date
+branch. Other dependency updates remain available for manual review and merge.
+This is a deterministic policy review; it does not claim to review arbitrary
+upstream source code or to provide an AI review.
+
+## Review policy
+
+`scripts/dependabot_review.py` checks the PR author is the Dependabot bot, both
+branches belong to this repository, the target is `main`, and the source is a
+`dependabot/uv/` branch. Only an existing `uv.lock` may change.
+
+The reviewer parses the base and head lockfiles and requires:
+
+- Only allowlisted, direct development dependencies change. A dependency
+  reachable from the runtime or any optional extra is excluded.
+- Versions move forward within the same major and minor version. Prereleases,
+  postreleases, downgrades, and nonstandard versions are excluded.
+- Dependency metadata, all other packages, and lockfile settings are unchanged.
+  Transitive updates and new packages require manual review. Unchanged alternative
+  platform/Python resolutions are retained exactly; runtime exclusion traverses
+  every alternative. Changes to a multiply resolved package require manual review.
+- Artifacts use the expected PyPI URLs and filenames with SHA-256 hashes. Every
+  URL, hash, and size must match PyPI's release metadata; yanked files are rejected.
+
+Malformed lockfiles and API failures fail the check. A well-formed PR outside
+the policy passes the check with a **manual merge required** decision and receives
+no automatic approval or merge request. SDK updates and GitHub Actions updates
+are outside the allowlist.
+
+## Workflow and trust boundary
+
+`dependabot-policy.yml` runs on every PR with a read-only token and checks out
+the **base commit's** review script. It reads PR lockfiles as data through the
+GitHub API; it never installs PR dependencies or executes PR code.
+
+After a successful required CI workflow run, `dependabot-auto-merge.yml` runs the **main-branch**
+script with narrowly scoped write permissions. It resolves the current PR from
+the triggering head SHA and repeats the review, including registry verification.
+Stale events are ignored. Before approving, it verifies required branch gates, confirms every required
+check succeeded, rechecks both base and head SHAs, and verifies the reviewed
+head contains current main through the comparison API. The review is attached
+to the reviewed commit; `gh pr merge --squash --match-head-commit` uses no
+administrator bypass. GitHub enforces the required tests and up-to-date-branch
+rule. A pending or failed check causes no write; the next successful workflow
+completion retries the review. The bot does not leave a persistent auto-merge
+request that could apply to a subsequently changed PR.
+
+The privileged workflow does not consume PR artifacts or caches. Both workflows
+use only the Python standard library and pinned actions. No additional secret,
+Adobe credential, or external review service is needed.
+
+## Repository settings
+
+The deployment enables **Allow auto-merge** and adds `dependabot-policy` to the
+existing required checks, with the GitHub Actions app as the check source:
+
+`lint`, `test (3.11)`, `test (3.12)`, `test (3.14)`, `browser-perf`, `check`, `verify`, `analyze (python, none)`, `analyze (javascript-typescript, none)`, `dependency-review`, `actionlint`, `lockfile`, `dependabot-policy`.
+
+Branch protection continues to require up-to-date branches and enforce the
+requirements for administrators. Existing review requirements are preserved;
+this setup does not introduce a second-maintainer requirement for human PRs.
+The dependency-review check rejects newly introduced vulnerabilities of moderate
+severity or higher. The test gates cover Python 3.11/3.12/3.14 tests with 99% combined line/branch coverage, Chromium and WebKit functional tests, browser performance, example drift, version identity, and Python/JavaScript CodeQL. Required CI sync and run commands use `--locked`.
+
+Install the workflow through a normal PR before requiring its new check. Its
+first installation PR is explicitly treated as a manual bootstrap because the
+trusted base does not contain the review script yet.
+
+## Existing PRs and maintenance
+
+To evaluate an existing PR without changes:
+
+```bash
+uv run --no-project --python 3.14 python scripts/dependabot_review.py \
+  --repo brian-a-au/sdr-visualizer --pr 74
+```
+
+After installation, dispatch the workflow to review an existing PR under the
+same policy and merge if eligible and all required checks have passed:
+
+```bash
+gh workflow run dependabot-auto-merge.yml --ref main -f pr=74
+```
+
+An old PR must also receive the new required `dependabot-policy` check before
+it can merge. Updating its branch through GitHub or a Dependabot rebase triggers
+fresh PR checks. If another PR merges first, GitHub requires the remaining PR
+to update and retest; automation never bypasses that requirement.
+
+The built-in `GITHUB_TOKEN` does not trigger ordinary push workflows when it
+merges a PR. Validation therefore happens before merging; main-branch badge
+refresh workflows may need a manual dispatch. Use a separately configured GitHub
+App if triggering those downstream workflows becomes necessary.
+
+To pause automatic merging, disable `dependabot-auto-merge.yml`. Keep the policy and existing required CI checks.
+Change the allowlist only through a reviewed repository PR.
+
+## Consistency across the SDR repositories
+
+This policy matches `aa_auto_sdr` and `cja_auto_sdr`: the same patch-only
+allowlist, trusted-base reviewer, PyPI artifact verification, required-check
+verification, and commit-bound protected squash merge. Runtime and optional-extra
+dependencies (including downstream optional dependencies), transitive changes,
+GitHub Actions, manifest changes, and updates outside the allowlist require
+manual review. Repository names, root package names, and CI contexts differ.
+
+Python updates are individual PRs so manual-review packages cannot hold an
+otherwise eligible patch in a mixed group. GitHub Actions updates remain grouped.
+No package version bump, tag, or publication is triggered by this automation.
+
+Automatic Copilot review is supplementary, requested on new PRs and each new
+push through a repository ruleset, subject to availability and quota. It does not
+replace policy review or CI, and no Copilot approval-counting feature is required.

{sdr_visualizer-1.2.2 → sdr_visualizer-1.2.4}/docs/LINEAGE.md

@@ -153,5 +153,8 @@ uv run python scripts/perf_lineage_poc.py
 ```
 
 Release review also needs full Python coverage, browser/performance gates,
-isolated wheel and sdist smoke checks, and a visual/assistive-technology pass.
-Automated assertions do not certify visual appearance or actual screen-reader use.
+isolated wheel and sdist smoke checks, and automated browser accessibility and
+keyboard checks. Manual assistive-technology testing, including VoiceOver or
+another screen reader, is optional and does not block release. Automated
+assertions do not certify accessibility, visual appearance, or actual
+screen-reader use.

{sdr_visualizer-1.2.2 → sdr_visualizer-1.2.4}/docs/PERFORMANCE.md

@@ -29,6 +29,12 @@ visualizer must hit all four targets for the applicable tier:
 | 1,000 components    | < 6 s      | < 4 MB           | < 1 s               | < 150 ms             |
 | 2,000 components    | < 12 s     | < 8 MB           | < 2 s               | < 300 ms             |
 
+All table boundaries are strict: a measurement equal to its limit fails.
+HTML size is measured in UTF-8 bytes using decimal units (1 KB = 1,000 bytes;
+1 MB = 1,000,000 bytes), so the four limits are 500,000, 2,000,000,
+4,000,000, and 8,000,000 bytes. The comparison/trend allowance is 500,000
+bytes, applied once.
+
 In plain terms:
 
 - **Build time** is how long Python takes to adapt the snapshot, analyze it,

{sdr_visualizer-1.2.2 → sdr_visualizer-1.2.4}/docs/PRODUCT_CONTRACT.md

@@ -207,8 +207,8 @@ unusable, and capped-out members do not warn. The current markers are:
 
 | Platform | Warning threshold |
 |---|---:|
-| CJA (`cja_auto_sdr`) | 3.12.4 |
-| AA (`aa_auto_sdr`) | 1.21.15 |
+| CJA (`cja_auto_sdr`) | 3.12.12 |
+| AA (`aa_auto_sdr`) | 1.21.24 |
 
 A marker is evidence of exercised compatibility, not a promise about every
 possible snapshot produced by that version. It may advance only after a

{sdr_visualizer-1.2.2 → sdr_visualizer-1.2.4}/docs/RELEASE_EVIDENCE_TEMPLATE.md

@@ -64,7 +64,7 @@ recorded.
 | Live CJA and AA | pending | operator authorization, privacy controls, credentials, and current generators | pending |
 | Compare and Trend | pending | qualified sanitized input set | pending |
 | CJA lineage | pending | qualified discovery input and authorized live access | pending |
-| Workspace usage | pending | explicit collection authorization, privacy controls, and platform credentials | pending |
+| Workspace usage | pending | explicit CJA collection authorization, privacy controls, and CJA credentials; AA live access optional | pending |
 | Fresh and historical corpus | pending | corpus operator and privacy reviewer assigned | pending |
 | Hosted settings and security | pending | exact-SHA runs and settings access | pending |
 | Artifact and publication | pending | candidate GO and separate tag authorization | pending |
@@ -75,6 +75,14 @@ recorded.
 Record commands, results, and durable exact-SHA evidence separately for each
 surface. Use `pending` until the required work has actually completed.
 
+Automated browser accessibility and keyboard checks are required for catalog and
+lineage reports. Manual assistive-technology testing, including VoiceOver, is
+optional; its absence is not a blocker or a pending required approval. Results do
+not certify accessibility or screen-reader use. License signoff covers the project
+LICENSE and vendored D3 ISC notices; no separate resolved or optional Python
+license review or license-owner approval is required. Third-party license
+obligations still apply.
+
 ### CLI and package surface
 
 | Evidence | Value |
@@ -83,8 +91,10 @@ surface. Use `pending` until the required work has actually completed.
 | Lock, lint, format, documentation-link, and workflow-policy results | pending |
 | Focused input-boundary result | pending |
 | Non-browser suite and coverage result | pending |
-| Package metadata, dependency export, audit, and license review | pending |
+| Package metadata, dependency export, audit, and project LICENSE / vendored D3 ISC notice signoff | pending |
 | Wheel and source-distribution smoke result | pending |
+| Catalog automated browser accessibility and keyboard result | pending |
+| Manual assistive-technology testing (optional; no release blocker) | not performed (optional) |
 | Durable evidence permalink | pending |
 
 ### Live CJA and AA
@@ -125,7 +135,7 @@ surface. Use `pending` until the required work has actually completed.
 | Evidence | Value |
 |---|---|
 | Saved and live discovery result | pending |
-| Layout, payload, renderer, CLI, and accessibility result | pending |
+| Layout, payload, renderer, CLI, and automated accessibility/keyboard result | pending |
 | Chromium and WebKit result | pending |
 | Performance result | pending |
 | Durable evidence permalink | pending |
@@ -138,8 +148,9 @@ surface. Use `pending` until the required work has actually completed.
 | AA fake-HTTP/actual-SDK result | pending |
 | Saved-evidence replay and binding result | pending |
 | Collection bounds, privacy, packaging, and optional-extra review | pending |
-| CJA and AA live-qualification authorization (pending blocks corresponding qualification) | pending |
-| Authorized CJA and AA live-qualification result | pending |
+| CJA live-qualification authorization (pending blocks qualification) | pending |
+| Authorized CJA live-qualification result | pending |
+| AA live Workspace collection (optional; no release blocker) | not performed (optional) |
 | Durable evidence permalink | pending |
 
 ## Fresh and historical corpus aggregate
@@ -189,7 +200,9 @@ cannot be closed by recording the current delta as diff-backed N/A.
 | Candidate SHA | pending |
 | Complete changed-path output permalink | pending |
 | Shared runtime paths changed | pending |
-| Full parity or diff-backed N/A evidence | pending |
+| Full parity review, marker-only disposition, or diff-backed N/A evidence | pending |
+| Marker-only: both projects' marker values and explicit-SHA adapter/helper review | pending |
+| Marker-only: fresh candidate qualification and literal warning-boundary evidence | pending |
 | Current sibling PR and commit permalinks, if applicable | pending |
 | Shared-contract comparator result, if applicable | pending |
 | Reviewer / reviewed UTC / result | pending |
@@ -237,11 +250,11 @@ renumber these requirements.
 | R11 immutable action pins | workflow-policy check | pending |
 | R12 PyPI-before-GitHub ordering | workflow-policy check + authorized tag run | pending |
 | R13 installed artifacts | wheel/sdist smoke + digests | pending |
-| R14 minimal runtime dependencies | metadata/export/audit/license evidence | pending |
+| R14 minimal runtime dependencies | metadata/export/audit and project/D3 notice evidence | pending |
 | R15 shipped, consistent docs | Markdown links + source-distribution check | pending |
 | R16 safe sharing guidance | README review | pending |
 | R17 current compatibility | privacy-safe fresh/corpus record | pending |
-| R18 sibling parity | linked green sibling PR/commit and passing shared-contract comparator when color packs change | pending |
+| R18 sibling parity | full sibling review; linked green merged sibling PR/commit unless the marker-only disposition applies; shared-contract comparator when color packs change | pending |
 | R19 protected/monitored `main` | settings/API inspection | pending |
 | R20 complete community surface | community profile + advertised public-link resolution | pending |
 | R21 one traced candidate | this matrix + final go/no-go | pending |
@@ -301,20 +314,29 @@ renumber these requirements.
 ## Authoritative artifact and retention
 
 Use one artifact set throughout. Record every retry separately; never combine
-evidence from different attempts or manifests.
+evidence from different attempts or manifests. Inspect retention settings before
+tagging; inspect the created artifact's actual expiry before PyPI publication
+approval. A configured duration does not establish the actual recovery deadline.
+The actual expiry must cover the recorded full 90-day policy window; stop if it
+falls short. Record the window start and its basis rather than inferring them
+from a previous release's retention behavior.
 
 | Field | Value |
 |---|---|
 | Release workflow URL | pending |
 | Workflow run ID | pending |
 | Attempt | pending |
+| Workflow creation UTC | pending |
 | Event / tag / `headSha` | pending |
 | Job conclusions | pending |
 | Retained artifact ID | pending |
 | Artifact URL | pending |
-| Artifact expiry UTC | pending |
-| Repository retention setting and inspection URL | pending |
-| 90-day recovery-window end UTC | pending |
+| Artifact creation UTC | pending |
+| Actual artifact expiry UTC and inspection URL | pending |
+| Repository retention setting / workflow retention request / pre-tag inspection URL | pending |
+| Policy-window start UTC and basis | pending |
+| 90-day recovery deadline UTC | pending |
+| Actual expiry covers the full policy window / post-build inspection UTC | pending |
 | Wheel filename / SHA-256 | pending |
 | Source-distribution filename / SHA-256 | pending |
 | Authoritative `SHA256SUMS` manifest URL | pending |